PT-2025-5703 · Juniper Networks · Junos+1
CVE-2024-39564
·
Published
2025-02-05
·
Updated
2026-01-26
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions:
Junos OS versions 22.4 through 22.4R3-S4
Junos OS Evolved versions 22.4 through 22.4R3-S4-EVO
Description:
A double-free vulnerability in the routing process daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a malformed BGP Path attribute update, allocating memory used to log the bad path attribute. This double free of memory causes an rpd crash, leading to a Denial of Service (DoS).
Recommendations:
For Junos OS versions 22.4 through 22.4R3-S4, update to version 22.4R3-S4.
For Junos OS Evolved versions 22.4 through 22.4R3-S4-EVO, update to version 22.4R3-S4-EVO.
As a temporary workaround, consider restricting access to the BGP Path attribute update to minimize the risk of exploitation.
Fix
DoS
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Junos
Junos Evolved